The Network of Online Stolen Data Markets: How Vendor Flows Connect Digital Marketplaces

Abstract

In the face of market uncertainty, illicit actors on the darkweb mitigate risk by displacing their operations across digital marketplaces. In this study, we reconstruct market networks created by vendor displacement to examine how digital marketplaces are connected on the darkweb and identify the properties that drive vendor flows before and after a law enforcement disruption. Findings show that vendors’ movement across digital marketplaces creates a highly connected ecosystem; nearly all markets are directly or indirectly connected. These network characteristics remain stable following a law enforcement operation; prior vendor flows predict vendor movement before and after the interdiction. The findings inform work on collective patterns in offender decision-making and extend discussions of displacement into digital spaces.

Follow the Money: Analyzing Darknet Activity Using Cryptocurrency and the Bitcoin Blockchain

“…Finally, although we are far from the first to examine illegal transactions on darknet markets (e.g., Howell et al, 2022; Ouellet et al, 2022), our article adds to the literature by examining these markets using novel and unique data. We are able to expand the understanding of criminologists by specifically considering heuristics within financial transactions.…”

A Depiction and Classification of the Stolen Data Market Ecosystem and Comprising Darknet Markets: A Multidisciplinary Approach

“…As the number of darknet markets has multiplied and scholastic inquiry has followed suit (Van Buskirk et al, 2017;Ladegaard, 2019Ladegaard, , 2020Norbutas et al, 2020;Soska & Christin, 2015) these studies have shed light on product (Duxbury & Haynie, 2018;Martin et al, 2018), vendor (Copeland et al, 2020;Jeziorowski et al, 2020), and market characteristics (Ball & Broadhurst, 2021;Cherqi et al, 2018;Roddy & Holt, 2022); however, less research has focused on the ecosystem in which these markets operate (cf. Broséus et al, 2016;Ouellet et al, 2022).…”

“…This sample of markets contained all (identifiable) English-language digital markets that advertised online stolen data. Guided by Ouellet et al (2022), stolen data products are defined here as fraudulent documents (e.g., drivers' licenses, passports), financial items (e.g., bank accounts, credit cards), counterfeit currencies, services to steal data (e.g., account crackers, injectors), and tutorials or guides related to any of the preceding categories.…”

“…These data were then compiled into a structured database file for analysis. Since some markets do not classify product listings or misclassify listings, we used a set of keywords (as identified by Ouellet et al, 2022) to extract the relevant listings for the analysis (see Appendix for a full list of keywords). As such, we only extracted data pertaining to online stolen data (as identified by the keywords) during the 8-month observational period.…”

“…Since the market's seizure, myriad markets have emerged to fill the void (Décary-Hétu & Giommoni, 2017;Ladegaard, 2019Ladegaard, , 2020Norbutas et al, 2020;Soska & Christin, 2015;Van Buskirk et al, 2017). These markets now function as a complex interconnected network (Ouellet et al, 2022) resembling what Moore (1993) referred to as a "business ecosystem. "…”